[Dubber Dan]

A Win XP Home pc with some funny things going on. I've removed some virii and cleaned it off with Ad Aware and Spybot but still getting some odd problems.

On logging in the pc keeps popping up connection messages saying it's trying to connect to a website. The address varies from 1.xdgz.com to irc.inet.tele.dk to google.com and more. Click cancel and it'll pop up again. Try to connect and the pc reboots itself.

In fact if I try to connect (via BT Broadband Basic ADSL) the pc usually just reboots itself. Sometimes it just fails to connect saying no response. I've checked the settings and they seem fine I think, but the number to be dialed is showing as 0,38 which seems odd to me. I've tried the installed BT help but it doesn't run properly. Tried reinstalling the BT stuff (modem drivers and connection fromt he original cd and it still doesn't work.

The other really weird thing is that when logging in Windows comes up with a message to say c:\windows\system32\license.cfg is missing or corrupt (I've looked for it and it's not on the pc.) and the suggests entering credit card details to get a new one!!! Now Micro$oft might be crap but I wouldn't have thought they'd do that so is this something dodgy? If so how do I get rid of it. If not how do I get the license.cfg back without sending credit card details?

Any suggestions?

Here's the HiJack This log:

Logfile of HijackThis v1.98.1
Scan saved at 21:02:42, on 23/09/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
C:\WINDOWS\System32\muamgrd.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb03.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\WINDOWS\System32\zesdiq.exe
C:\WINDOWS\System32\rxhost.exe
C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe
C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe
C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\rxhost.exe
C:\Program Files\BT Broadband Basic Help\bin\mpbtn.exe
C:\WINDOWS\System32\wuauclt.exe
C:\PROGRA~1\Motive\ASSTCO~1\MOTIVE~1.EXE
C:\Program Files\BT Broadband Basic Help\bin\mad.exe
C:\WINDOWS\System32\rasautou.exe
C:\Program Files\Hijack This\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.iesearch....rch/default.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.freeserve.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.freeserve.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.freeserve.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Freeserve
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=http://www-cache.freeserve.com:8080;ftp=http://www-cache.freeserve.com:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;<local>
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb03.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [Windows Shell Library Loader] load shell.dll /c /set -- by windows setup --
O4 - HKLM\..\Run: [Microsoft Update] muamgrd.exe
O4 - HKLM\..\Run: [wincx] wincore332.exe
O4 - HKLM\..\Run: [BIOS XP Loader] zesdiq.exe
O4 - HKLM\..\Run: [WSSAConfiguration] wmmon32.exe
O4 - HKLM\..\Run: [IpCtrl] C:\WINDOWS\ipcon32.exe
O4 - HKLM\..\Run: [DirectX Video Driver] C:\WINDOWS\dxterm5.exe
O4 - HKLM\..\Run: [Sync32x2] C:\WINDOWS\sync32x2.exe
O4 - HKLM\..\Run: [Sw32] C:\WINDOWS\sw32.exe
O4 - HKLM\..\Run: [Microsoft Update Machine] rxhost.exe
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [DSLSTATEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe icon
O4 - HKLM\..\Run: [DSLAGENTEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe
O4 - HKLM\..\RunServices: [Microsoft Update] muamgrd.exe
O4 - HKLM\..\RunServices: [wincx] wincore332.exe
O4 - HKLM\..\RunServices: [BIOS XP Loader] zesdiq.exe
O4 - HKLM\..\RunServices: [WSSAConfiguration] wmmon32.exe
O4 - HKLM\..\RunServices: [Microsoft Update Machine] rxhost.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [BIOS XP Loader] zesdiq.exe
O4 - HKCU\..\Run: [Microsoft Update Machine] rxhost.exe
O4 - Global Startup: Billminder.lnk = C:\quickenw\BILLMIND.EXE
O4 - Global Startup: BT Broadband Basic Help.lnk = C:\Program Files\BT Broadband Basic Help\bin\matcli.exe
O8 - Extra context menu item: Web Search - c:\windows\ex.htm
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Medion-UK - {98296527-3BF1-44B8-A3A5-FA9848DA5C40} - http://www.medion.co.uk (file missing) (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.freeserve.com/
O18 - Protocol: emistp - {0EFAEA2E-11C9-11D3-88E3-0000E867A001} - C:\WINDOWS\system32\EmisAPP.dll

[Advertisements]

Hey Dubber. Welcome to Geeks to Go.

You have some malware on your machine and we will need to do several things in order to get it cleaned up. A handful I researched already occurred because windows was not updated. As soon as we get this fixed, you need to update windows immediately, or we will have both wasted our time.

After you run each program, I want you to clean out your temp files and reboot. (See following instructions)

Please delete your temporary files. Double Click My Computer (WinXP: Navigate to Start --->My Computer)
You will see an icon representing your harddrive (most likely C: Drive) Right Click on the hard drive icon and click Properties at the
bottom of the fly out window. One the very first tab (General) you will see a button labeled "Disk Cleanup"...click that button.
Make sure the following are checked:
Downloaded Program Files
Temporary Internet Files and
Recycle Bin


Your computer has a number of spyware programs that we need to remove.

Let's start with a couple of free programs:
CWShredder is the first to run. Here's why a CoolWebSearch variant is running on your system, it may actually prevent you from running spyware scans. It is smart enough to detect efforts to detect it, and stop them. Download CWShredder to your desktop or other location. Close all browser windows, double click the CWShredder icon to run, then click the Fix -> button. When finished, reboot and run Spybot Search & Destroy.

Spybot Search & Destroy Download and install. Start Spybot S&D using the "Spybot-S&D (easy mode)" link from your Start menu . Click the Search for updates button, if any are found then click the Download Updates button. After all updates are downloaded, click the Check for problems button. When the scan is complete, place a check next to anything marked in red, then click the Fix selected problems button. You may need to run Spybot S&D multiple times to remove all infections.

Reboot

Download Ad-aware from: http://www.geekstogo...n=download&id=5

Install the program and launch it.

First, in the main window, look in the bottom right corner and click on Check for updates now and download the latest reference files.

Next, we need to configure Ad-aware for a full scan.

-> Click on the Gear icon (second from the left) to access the preferences/settings window

1. In the General window make sure the following are selected:

• Automatically save log-file
• Automatically quarantine objects prior to removal
• Safe Mode (always request confirmation)

2. Click on the Scanning button on the left and select :

• Scan Within Archives
• Scan Active Processes
• Scan Registry
• Deep Scan Registry
• Scan my IE favorites for banned URL’s
• Scan my Hosts file
• Under Click here to select drives + folders, choose:
• All of your hard drives

-> Click on the Advanced button on the left and select:

• Include additional process information
• Include additional file information
• Include environment information
• Include additional object details

-> Click the Tweak button and select:

• Under the Scanning Engine:
  • Unload recognized processes during scanning
  • Include basic Ad-aware settings in logfile
  • Include additional Ad-aware settings in logfile
• Under the Cleaning Engine:
  • Let Windows remove files in use at next reboot

-> Click on Proceed to save the settings.

-> Click Start and on the next screen choose Activate in-depth Scan at the bottom of the page and then choose:

• Use Custom Scanning Options

-> Click Next and Ad-aware will scan your hard drive(s) with the options you have selected.

-> Save the log file when it asks and then click Finish

-> When finished, mark everything for removal and get rid of it. (Right-click the window and choose Select All from the drop down menu and click Next).

-> Reboot your computer.


Please run a free online virus scan here (tick the "Auto Clean" checkbox):
http://housecall.antivirus.com/

Reboot

And a free trojan scan here:
http://www.moosoft.com/

reboot and post a fresh log.

Edited by coachwife6, 24 September 2004 - 11:28 AM.

[coachwife6]

Hey Dubber. Welcome to Geeks to Go.

You have some malware on your machine and we will need to do several things in order to get it cleaned up. A handful I researched already occurred because windows was not updated. As soon as we get this fixed, you need to update windows immediately, or we will have both wasted our time.

After you run each program, I want you to clean out your temp files and reboot. (See following instructions)

Please delete your temporary files. Double Click My Computer (WinXP: Navigate to Start --->My Computer)
You will see an icon representing your harddrive (most likely C: Drive) Right Click on the hard drive icon and click Properties at the
bottom of the fly out window. One the very first tab (General) you will see a button labeled "Disk Cleanup"...click that button.
Make sure the following are checked:
Downloaded Program Files
Temporary Internet Files and
Recycle Bin


Your computer has a number of spyware programs that we need to remove.

Let's start with a couple of free programs:
CWShredder is the first to run. Here's why a CoolWebSearch variant is running on your system, it may actually prevent you from running spyware scans. It is smart enough to detect efforts to detect it, and stop them. Download CWShredder to your desktop or other location. Close all browser windows, double click the CWShredder icon to run, then click the Fix -> button. When finished, reboot and run Spybot Search & Destroy.

Spybot Search & Destroy Download and install. Start Spybot S&D using the "Spybot-S&D (easy mode)" link from your Start menu . Click the Search for updates button, if any are found then click the Download Updates button. After all updates are downloaded, click the Check for problems button. When the scan is complete, place a check next to anything marked in red, then click the Fix selected problems button. You may need to run Spybot S&D multiple times to remove all infections.

Reboot

Download Ad-aware from: http://www.geekstogo...n=download&id=5

Install the program and launch it.

First, in the main window, look in the bottom right corner and click on Check for updates now and download the latest reference files.

Next, we need to configure Ad-aware for a full scan.

-> Click on the Gear icon (second from the left) to access the preferences/settings window

1. In the General window make sure the following are selected:

• Automatically save log-file
• Automatically quarantine objects prior to removal
• Safe Mode (always request confirmation)

2. Click on the Scanning button on the left and select :

• Scan Within Archives
• Scan Active Processes
• Scan Registry
• Deep Scan Registry
• Scan my IE favorites for banned URL’s
• Scan my Hosts file
• Under Click here to select drives + folders, choose:
• All of your hard drives

-> Click on the Advanced button on the left and select:

• Include additional process information
• Include additional file information
• Include environment information
• Include additional object details

-> Click the Tweak button and select:

• Under the Scanning Engine:
  • Unload recognized processes during scanning
  • Include basic Ad-aware settings in logfile
  • Include additional Ad-aware settings in logfile
• Under the Cleaning Engine:
  • Let Windows remove files in use at next reboot

-> Click on Proceed to save the settings.

-> Click Start and on the next screen choose Activate in-depth Scan at the bottom of the page and then choose:

• Use Custom Scanning Options

-> Click Next and Ad-aware will scan your hard drive(s) with the options you have selected.

-> Save the log file when it asks and then click Finish

-> When finished, mark everything for removal and get rid of it. (Right-click the window and choose Select All from the drop down menu and click Next).

-> Reboot your computer.


Please run a free online virus scan here (tick the "Auto Clean" checkbox):
http://housecall.antivirus.com/

Reboot

And a free trojan scan here:
http://www.moosoft.com/

reboot and post a fresh log.

Edited by coachwife6, 24 September 2004 - 11:28 AM.

[Dubber Dan]

Thanks for the reply. As you'll see from my original post I've used Spybot and Ad Aware and also used an anitvirus prog (AVG) to remove some virii. The one snag with your suggestions is that I can't update any of the progs as the internet connection on this pc causes the pc to reboot!!!

I'll download the CWShredder at work and burn onto cd. Is there a way of getting the latest updates fro Spyobt et al via a different pc? I've downloaded the latest version of the progs at work but as with these things I doubt it's properly up to date.

Any ideas?

[admin]

Please go offline, close all browsers and any open Windows, making sure that only HijackThis is open. Scan and when it finishes, put an X in the boxes, only next to these following items, then click fix checked.
O4 - HKLM\..\Run: [Windows Shell Library Loader] load shell.dll /c /set -- by windows setup --
O4 - HKLM\..\Run: [Microsoft Update] muamgrd.exe
O4 - HKLM\..\Run: [wincx] wincore332.exe
O4 - HKLM\..\Run: [BIOS XP Loader] zesdiq.exe
O4 - HKLM\..\Run: [WSSAConfiguration] wmmon32.exe
O4 - HKLM\..\Run: [IpCtrl] C:\WINDOWS\ipcon32.exe
O4 - HKLM\..\Run: [DirectX Video Driver] C:\WINDOWS\dxterm5.exe
O4 - HKLM\..\Run: [Sync32x2] C:\WINDOWS\sync32x2.exe
O4 - HKLM\..\Run: [Sw32] C:\WINDOWS\sw32.exe
O4 - HKLM\..\Run: [Microsoft Update Machine] rxhost.exe
O4 - HKLM\..\RunServices: [Microsoft Update] muamgrd.exe
O4 - HKLM\..\RunServices: [wincx] wincore332.exe
O4 - HKLM\..\RunServices: [BIOS XP Loader] zesdiq.exe
O4 - HKLM\..\RunServices: [WSSAConfiguration] wmmon32.exe
O4 - HKLM\..\RunServices: [Microsoft Update Machine] rxhost.exe
O4 - HKCU\..\Run: [BIOS XP Loader] zesdiq.exe
O4 - HKCU\..\Run: [Microsoft Update Machine] rxhost.exe
O8 - Extra context menu item: Web Search - c:\windows\ex.htm
O18 - Protocol: emistp - {0EFAEA2E-11C9-11D3-88E3-0000E867A001} - C:\WINDOWS\system32\EmisAPP.dll

Please reboot into safe mode - How do I boot into "Safe" mode?.
Be sure you're able to view hidden files, and remove the following files in bold (if found):
C:\WINDOWS\System32\muamgrd.exe
C:\WINDOWS\System32\wincore332.exe
C:\WINDOWS\System32\zesdiq.exe
C:\WINDOWS\System32\wmmon32.exe
C:\WINDOWS\ipcon32.exe
C:\WINDOWS\dxterm5.exe
C:\WINDOWS\sync32x2.exe
C:\WINDOWS\sw32.exe
C:\WINDOWS\System32\rxhost.exe
c:\windows\ex.htm
C:\WINDOWS\system32\EmisAPP.dll

Reboot your PC.

If you would please, rescan with HijackThis and post a fresh log in this same topic, and let us know how your system's working.

[Dubber Dan]

Done all those things and were maiking progress at last. Can now get in the net on the pc in question so should make further diagnosis a bit easier!!

Am now getting messages come up whenever the pc is used to say that Trojan.Downloader.Small has been detected.

I've deleted the files it's found in, rebooted, cleared temp internet files (all with no system restore) but it still keeps coming back.

Here's the latest HijackThis log:


Logfile of HijackThis v1.98.1
Scan saved at 17:17:36, on 25/10/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\win32usb.exe
C:\WINDOWS\System32\winudap.exe
C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe
C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe
C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe
C:\WINDOWS\System32\vpc32.exe
C:\WINDOWS\System32\SVCH0ST.exe
C:\WINDOWS\System32\svchost32.exe
C:\WINDOWS\System32\tres32.exe
C:\WINDOWS\System32\xafpmz.exe
C:\Program Files\Win Comm\WinComm.exe
C:\Program Files\Win Comm\WinLock.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Hijack This\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.iesearch....rch/default.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.freeserve.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.freeserve.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Freeserve
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: ADP UrlCatcher Class - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} - C:\WINDOWS\System32\msbe.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb03.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [DSLSTATEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe icon
O4 - HKLM\..\Run: [DSLAGENTEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe
O4 - HKLM\..\Run: [Microsoft Update] vpc32.exe
O4 - HKLM\..\Run: [CRC Value Verifier] svchost32.exe
O4 - HKLM\..\Run: [USB Device] win32usb.exe
O4 - HKLM\..\Run: [Windows Services Update] SVCH0ST.exe
O4 - HKLM\..\Run: [Win32 USB2 Driver] elite.exe
O4 - HKLM\..\Run: [OEM Tools 32] tres32.exe
O4 - HKLM\..\Run: [winudap.exe] winudap.exe
O4 - HKLM\..\Run: [Win Users2] xafpmz.exe
O4 - HKLM\..\Run: [Win Comm] C:\Program Files\Win Comm\WinComm.exe
O4 - HKLM\..\RunServices: [Microsoft Update] vpc32.exe
O4 - HKLM\..\RunServices: [CRC Value Verifier] svchost32.exe
O4 - HKLM\..\RunServices: [USB Device] win32usb.exe
O4 - HKLM\..\RunServices: [Windows Services Update] SVCH0ST.exe
O4 - HKLM\..\RunServices: [Win32 USB2 Driver] elite.exe
O4 - HKLM\..\RunServices: [OEM Tools 32] tres32.exe
O4 - HKLM\..\RunServices: [winudap.exe] winudap.exe
O4 - HKLM\..\RunServices: [Win Users2] xafpmz.exe
O4 - HKLM\..\RunOnce: [USB Device] win32usb.exe
O4 - HKLM\..\RunOnce: [Win32 USB2 Driver] elite.exe
O4 - HKLM\..\RunOnce: [winudap.exe] winudap.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [USB Device] win32usb.exe
O4 - HKCU\..\Run: [Microsoft Update] vpc32.exe
O4 - HKCU\..\Run: [Win32 USB2 Driver] elite.exe
O4 - HKCU\..\Run: [winudap.exe] winudap.exe
O4 - HKCU\..\Run: [OEM Tools 32] tres32.exe
O4 - HKCU\..\RunOnce: [Win32 USB2 Driver] elite.exe
O4 - HKCU\..\RunOnce: [USB Device] win32usb.exe
O4 - HKCU\..\RunOnce: [winudap.exe] winudap.exe
O4 - Global Startup: Billminder.lnk = C:\quickenw\BILLMIND.EXE
O4 - Global Startup: BT Broadband Basic Help.lnk = C:\Program Files\BT Broadband Basic Help\bin\matcli.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Medion-UK - {98296527-3BF1-44B8-A3A5-FA9848DA5C40} - http://www.medion.co.uk (file missing) (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.freeserve.com/
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1098214154045

[coachwife6]

You are still majorly infected. Please read my first post where I asked you to update windows.

The first step in this process is to apply Service Pack 1a for Windows XP. Without this update, you're wide open to re-infection, and we're both just wasting our time.
Click here: http://www.microsoft...p1/default.mspx
Apply the update, reboot, and post a fresh Hijack This log.

Some hijacks interfere with the installation of Service Pack 2, so we'll hold of for now. When we're finished cleaning your computer we highly recommend installing SP2. Click here: http://windowsupdate.microsoft.com/.
-or-
It's a very large download, so if you're on dial-up, order a free CD here:
http://www.microsoft...default810.mspx

Edited by coachwife6, 25 October 2004 - 11:47 AM.

[Dubber Dan]

I have updated Windows with all updates up to SP2. As I said, I carried out all the advice above

[-=jonnyrotten=-]

But, you did not update to Service Pack 1a. Not accusing you of trying to fool us, but keep in mind the you cannot fool a geek and it is clear that you do not have service pack 1a.
Click here: http://www.microsoft...p1/default.mspx
This is a direct link to downloading service pack 1a. After downloading and installing go to http://windowsupdate.microsoft.com and download all new updates except service pack 2
We can then help you keep your system clean. As of right now, the infections come back through the same holes in windows you had when you started.

-=jonnyrotten=-